Unescaped

Unescaped refers to characters or strings that have not been modified by an escape sequence. In computing, escaping is the process of prefixing a character with another—often a backslash (\\), a percent sign (%), or similar—to indicate that it should be treated literally rather than interpreted according to its usual syntax. When data remains unescaped, the software that processes it may interpret special characters as control instructions, which can lead to errors, incorrect parsing, or security vulnerabilities.

In programming and scripting, unescaped input is a common source of injection attacks. For example, an SQL query that inserts data directly into a statement without escaping quotes will allow a malicious user to alter the query logic. Similarly, HTML or XML that contains unescaped “<”, “>”, or “&” characters can cause markup injection or cross‑site scripting attacks. Escaping these characters ensures that they are rendered as text rather than parsed as markup or code.

Different languages and data formats provide standard escaping mechanisms. In many programming languages, a backslash escapes the next character, turning “\n” into a line‑feed and “\\” into a literal backslash. In URLs, characters outside the set of unreserved symbols are percent‑encoded, turning a space into “%20”. JSON strings escape quotation marks and control characters with backslashes. XML and HTML use entities such as &lt; for “<”.

Best practices advise performing escaping at the boundary where untrusted data enters a system—either before incorporating user input into a database query or before rendering it in a web page. Libraries and frameworks often automate this process, but developers must still understand the underlying rules to avoid double‑escaping or forgetting to escape new data contexts. By ensuring that all special characters are properly escaped, software can process inputs reliably and securely.